simple iptables based packet limiter to deflect DoS attacks on our clients

git-svn-id: https://dev.arachne.cz/repos/prometheus/trunk@232 251d49ef-1d17-4917-a970-b30cf55b089b

diff --git a/ipstruct.h b/ipstruct.h
index 4f1d9aac8fbb362fceb403dc3761ea5bc9f743ef..72bf976b87406945115a4fdb8b278161e338a32e 100644 (file)
--- a/ipstruct.h
+++ b/ipstruct.h
@@ -13,6 +13,7 @@ struct IP
  int fixedprio;\r
  int group;\r
  int lmsid;\r
+ int pps_limit;\r
  unsigned long long direct;\r
  unsigned long long proxy;\r
  unsigned long long upload;\r

diff --git a/parsehosts.c b/parsehosts.c
index ac9b39fd47c374f23c965bb159f3223c2648258c..5014ffb8287cb168d2c6b5df709745ddb25eff7d 100644 (file)
--- a/parsehosts.c
+++ b/parsehosts.c
@@ -40,6 +40,7 @@ void TheIP(char *ipaddr, int is_network)
  ip->direct      = \\r
  ip->traffic     = \\r
  ip->pktsup      = \\r
+ ip->pps_limit   = \\r
  ip->pktsdown    = 0;\r
  ip->keyword     = keywords;\r
  ip->v6          = (strchr(ip->addr,':')!=NULL);\r
@@ -252,12 +253,14 @@ void parse_hosts(char *hosts)
      else \r
      {\r
       ip->max -= ip->keyword->reserve_max;\r
-      if(ip->max<ip->min)\r
+      if(ip->max < ip->min)\r
       {\r
-       ip->max=ip->min;\r
+       ip->max = ip->min;\r
       }\r
      }\r
-\r
+     \r
+     /* MTU is 1450 bytes = 11600 bits ~= 12 kbit, max is in kb/s */\r
+     ip->pps_limit = ip->max/12;\r
      ip->mark = FIRSTIPCLASS+1+class_count++;\r
      update_network(ip->addr, ip);\r
 \r

diff --git a/prometheus.c b/prometheus.c
index 3dfcc1a7ed8da2d7222cd64a1ef3d8a025a669dd..c88857b6268e57d9767d419573c0afb15f8c501b 100644 (file)
--- a/prometheus.c
+++ b/prometheus.c
@@ -7,7 +7,7 @@
 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */\r
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
 \r
-/* Modified by: xChaos, 20131029\r
+/* Modified by: xChaos, 20131118\r
                  ludva, 20080415\r
  \r
    Prometheus QoS is free software; you can redistribute it and/or\r
@@ -29,7 +29,7 @@
 #include "cll1-0.6.2.h"\r
 #include "ipstruct.h"\r
 \r
-const char *version = "0.8.3-i";\r
+const char *version = "0.8.3-j";\r
 \r
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */\r
@@ -118,10 +118,6 @@ int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shapi
 int       keywordcount = 0;\r
 int        class_count = 0;\r
 int           ip_count = 0;\r
-/* not yet implemented:\r
-int      fixed_packets = 0; maximum number of pps per IP address (not class!) \r
-int       packet_limit = 5; maximum number of pps to htn CEIL, not rate !!! \r
-*/\r
 FILE         *log_file = NULL;\r
 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */\r
 \r
@@ -469,7 +465,7 @@ program
  int i=0;                    /* just plain old Fortran style integer :-) */\r
  FILE *f=NULL;               /* everything is just stream of bytes... */\r
  char *str, *ptr, *d;        /* LET A$=B$ :-) */\r
- char *substring;\r
+ char *substring, *limit_pkts;\r
 \r
  int parent        = 1;\r
  int just_networks = FALSE;  \r
@@ -563,7 +559,8 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
  /*-----------------------------------------------------------------*/\r
  /* cll1.h - let's allocate brand new character buffer...           */\r
  /*-----------------------------------------------------------------*/\r
- string(str,STRLEN); \r
+ string(str, STRLEN); \r
+ string(limit_pkts, STRLEN);\r
 \r
  /*-----------------------------------------------------------------*/\r
  printf("Parsing class defintion file %s ...\n", hosts);\r
@@ -586,6 +583,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    ip->traffic = 0;\r
    ip->mark = sharedip->mark; \r
    ip->lmsid = sharedip->lmsid;\r
+   ip->pps_limit = sharedip->pps_limit; /* no other way to do this */\r
    break;\r
   }\r
   if(not sharedip)\r
@@ -1136,19 +1134,24 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   /* -------------------------------------------------------- mark download */\r
   \r
   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",\r
-               chain_postrouting, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);\r
+               chain_postrouting, ip->addr, 32*(1+ip->v6),\r
+               lan, mark_iptables, ip->mark);\r
   /* -m limit --limit 1/s */  \r
   iptables_save_line(str, ip->v6);\r
 \r
   if(qos_proxy)\r
   {\r
    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",\r
-                chain_postrouting, proxy_ip, proxy_port, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);\r
+                chain_postrouting, proxy_ip, proxy_port, ip->addr,\r
+                32*(1+ip->v6), lan, mark_iptables, ip->mark);\r
    iptables_save_line(str, ip->v6);\r
   }\r
 \r
-  sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",\r
-               chain_postrouting, ip->addr, 32*(1+ip->v6), lan);\r
+  /* this will be optional in future - hardcoded for now*/\r
+  sprintf(limit_pkts,"-m limit --limit %d/s ", ip->pps_limit);\r
+\r
+  sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",\r
+               chain_postrouting, ip->addr, 32*(1+ip->v6), lan, limit_pkts);\r
   iptables_save_line(str, ip->v6);\r
 \r
   /* -------------------------------------------------------- mark upload */\r
@@ -1156,8 +1159,8 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);\r
   iptables_save_line(str, ip->v6);\r
 \r
-  sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",\r
-               chain_forward, ip->addr, 32*(1+ip->v6), wan);\r
+  sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",\r
+               chain_forward, ip->addr, 32*(1+ip->v6), wan, limit_pkts);\r
   iptables_save_line(str, ip->v6);\r
 \r
   if(ip->min)\r
@@ -1168,7 +1171,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 #endif\r
 \r
    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d", \r
-                tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);\r
+                tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);\r
    safe_run(str);\r
 \r
    if(strcmpi(ip->keyword->leaf_discipline, "none"))\r